ABS Hacking

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
User avatar
delcowizzid
Posts: 5493
Joined: Sat Feb 28, 2009 8:38 pm
Location: Wellington NZ
Contact:

Re: ABS Hacking

Post by delcowizzid »

Looks a lot like the 2002 corvette abs unit I repaired yesterday seems they are bad for lifting the solder off the pads on the 12v + and - terminals where they attach on the board reflowed it and she's mint and talking to the data bus again
If Its Got Gas Or Ass Count Me In.if it cant be fixed with a hammer you have an electrical problem
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Post by NSFW »

In-Tech wrote:Would those be toroid's for signal conditioning? The other side of the board is very similar to the insides of the MEFI controllers with the goo and the tiny wires from board to pins.
I'm pretty sure they're for driving the solenoid valves. The other half of the module has a dozen metal pegs that fit into them.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: ABS Hacking

Post by NSFW »

jlvaldez wrote:Well that is interesting... Now I'm wondering how hard it would be to actuate those valves then... Is the only option for us to design a new board that controls that actuator board? Those look like bond wires suspended in the potting material? I'm not sure what those would be. Very interesting.
It's tempting to just replace all of the electronics and try to drive the valves directly. Instead of reprogramming the brain, just replace it. That level of PCB design is over my head but it sounds do-able.

There would still be some nontrivial things to figure out, though. Like which pins do what on the connector to the solenoid board, how to interface with the solenoids and the wheel speed sensors, and what messages it needs to send to the VPW bus to keep the rest of the car happy.

And how to interface with the VPW bus. I thought that was a solved problem when I found this GitHub library, but I built one and it can't receive.
And when I hook it to my OBD2/PCM setup nothing else on the bus can communicate:
https://github.com/matafonoff/J1850-VPW ... er-Library
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
User avatar
Gampy
Posts: 2331
Joined: Sat Dec 15, 2018 7:38 am

Re: ABS Hacking

Post by Gampy »

NSFW wrote:The other half of the module has a dozen metal pegs that fit into them.
Do you happen to have an image ??
Do the pegs move ??
Intelligence is in the details!

It is easier not to learn bad habits, then it is to break them!

If I was here to win a popularity contest, their would be no point, so I wouldn't be here!
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

Designing the PCB is something I'm comfortable with, but I'm not sure about how to source the pins/connectors that are needed. I'm honestly not even sure how we would have to drive those solenoids... I guess if anyone has any ideas how to ID a part number for those giant solenoid drivers, the datasheet would likely give me relevant information needed to design a circuit to drive it.

I see a few advantages:
1) We should be able to kill ice mode altogether, since we'd write the firmware
2) fixed/adjustable proportioning. A big issue with these modules is when they have an issue, the ABS module goes to 50/50 split brake force and I lock my rears up well before my BBK in the front gets enough volume to do any braking.

downsides:
1) Unforeseen issues?
2) if an OEM ecu is used, the lack of expected data packets over VPW from the device are going to put the ECU into an error state, or set some warning
3) Probably will break handling a bit if the dynamic braking does more than we expect...


Regarding communicating on J1850 VPW, I have another project I've been working on extensively over the last 2 months for a C5 project for racing. I'm using a MCU with a STN1110 to handle the J1850 phy and protocol. It's basically an ELM327 with more features in a single IC. Software gets easier since you only have to deal with UART and the data you want to send and receive, rather than the low-level specifics of the VPW physical layer (not the mention the difficulties of ensuring relatively accurate timing with a software-driven approach).

I can venture a guess at what is going on with those unlabeled ICs, as I've personally been involved in projects that do the same thing. Often times when making custom ICs for certain customers, any package labels are intentionally not placed on the package. The only way to identify such ICs is to literally cut the top off the package, and view the die inside. Most manufacturers will have a metal layer with the part number on the die. Granted, this is obviously no off the shelf part, so that part number is likely useless to us, as we would find no datasheet, no information at all.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ABS Hacking

Post by Tazzi »

To keep the car happy, usually a 'heartbeat' is sent out from every module to indicate it is present. Other modules such as the instrument cluster (IPC) will check for these frames, and will throw a fault on screen if it does not occur within its allocated threshold. Usually frames are sent every 1-4seconds.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

I've noticed the same. The ABS module appears to be a bit different though. I tried emulating the ABS module by sending the 0x03 heartbeat message via a program and the cluster and ECU were not fooled by this.
Upon key on, you can see a few messages are sent by the ABS module as well outside of the normal 0x03 heartbeat.

Here's the first messages sent by the ABS module upon key on:

Code: Select all

68 85 28 42 00 91  <===
89 32 10 62 5C
68 85 28 03 06 79  <===
88 25 28 43 00 DF  <===
88 53 40 11 3E
A8 F3 10 11 00 11
88 2B 10 0B 00 00 F1
88 3B 10 03 80 E7
8A EA 28 A0 95 00 34  <===
8A EA 28 20 96 00 20  <===
8A EA 28 A0 99 00 43  <===
C8 4B 10 14 00 E8
A8 DF 60 12 10 D8
8A EA 28 20 9B 00 1B  <===
C8 53 10 22 8E A5
8A D3 58 84 22 83
8A EA 28 20 C2 00 53  <===
C9 32 40 60 AC
A9 2A 28 4B EB  <===
AA EB 60 A0 95 00 7E
I'm not sure what most of these messages contain as the PRN used is not in any of the documents that I have.

I know there is also the torque request and delivered signals. You can see these early on in this thread that I measured with a scope to be ~70-120 hz PWM signals, where the duty cycle is measured to determine the value. Unexpected values here appear to set errors as well, though I need to play with this one a bit more on a bench.
User avatar
Tazzi
Posts: 3422
Joined: Thu May 17, 2012 8:53 pm
cars: VE SS Ute
Location: WA
Contact:

Re: ABS Hacking

Post by Tazzi »

might need to filter the 0x28 ID (If thats the ABS?) for a longer period to see if it does send a different message periodically.
Your Local Aussie Reverse Engineer
Contact for Software/Hardware development and Reverse Engineering
Site:https://www.envyouscustoms.com
Mob:+61406 140 726
Image
jlvaldez
Posts: 155
Joined: Mon Feb 11, 2019 12:48 pm
cars: '01 - Corvette Z06
'20 - Sierra Denali
'03 - Volvo S80 T6
'16 - Accord V6
Location: DFW, Texas

Re: ABS Hacking

Post by jlvaldez »

Yeah, 0x28 is ABS. I've got lotsssss of logs monitoring the bus (with my little python datalogger utility I made earlier in this thread). The ABS module does send the 0x03 heartbeat like all the other modules, but that's the only periodic message i see outside of those 3 broadcasts to 0xEA every few seconds. Not sure if they're a wheel speed data or what. Haven't driven my car around enough to try and figure it out. It's kind of hard to determine it.
Post Reply